FEATUREDComputing Life · Share (鸭哥 research reports)· rssZH00:00 · 06·16
→Agentjacking: Fake Sentry errors hijack Claude Code with 85% success rate
Tenet Security disclosed Agentjacking: attackers submit fake Sentry error events using your publicly exposed frontend DSN, embedding malicious commands disguised as fix suggestions. When your AI coding agent pulls Sentry issues via MCP and auto-fixes bugs, it follows the injected instructions 85% of the time. Tests covered 100+ instances across Claude Code, Cursor, and Codex. Passive scanning found 2,388 organizations with exposed DSNs, including a ~$250B Fortune 500 company. Every step in the chain is authorized—EDR, WAF, and firewalls see nothing. The root cause isn't Sentry; AI agents can't distinguish data they read from instructions to act. The same pattern has been confirmed in WhatsApp MCP, web scraper MCP, Cursor rules files, Claude Code file reads, and RAG systems. Smarter prompts won't fix this because trusted instructions and untrusted data merge into the same token stream with no architectural boundary. Sentry declined a root-cause fix, adding only a bypassable content filter. Current defenses—sandboxing, least privilege, human approval—only limit blast radius, not the injection itself.
#Tenet Security#Anthropic Claude Code#Cursor
why featured
Featured · importance 88 · hook + knowledge + resonance
editor take
AI coding agents can't tell data from instructions—85% attack success rate, Sentry is just the first mass-verified entry point.
sharp
This one's worth opening because the attack chain is absurdly clean: no exploits, no bypasses, every step is authorized. An attacker uses your publicly exposed frontend Sentry DSN to submit a fake error event, embedding a malicious command disguised as a fix suggestion. When Claude Code pulls Sentry issues via MCP and auto-fixes bugs, it follows the injected instructions 85% of the time.
Tenet Security tested 100+ instances across Claude Code, Cursor, and Codex. Passive scanning found 2,388 organizations with exposed DSNs, including a ~$250B Fortune 500 company. EDR, WAF, firewalls see nothing—because every step is legitimate.
The problem isn't Sentry. WhatsApp MCP, web scraper MCP, Cursor rules files, Claude Code file reads, RAG systems—same pattern confirmed across the board: attackers hide instructions in data the agent reads, and the agent executes them. Simon Willison calls this a confused deputy problem—the agent has your full permissions but is manipulated by untrusted data to act on the attacker's behalf.
The unsettling part is the defense result: smarter prompts don't fix this. LLMs architecturally cannot distinguish trusted instructions from untrusted data—they merge into the same token stream. Same root cause as SQL injection, where the fix wasn't smarter databases but parameterized queries that separate code from data at the format level. In the agent context, no equivalent mature solution exists yet. Sentry added only a bypassable content filter and declined a root-cause fix.
Current defenses—sandboxing, least privilege, human approval—only limit blast radius, not the injection itself.
HKR breakdown
hook ✓knowledge ✓resonance ✓